fix: allow AF_UNIX sockets for nix daemon communication

The flake collector needs Unix domain sockets to communicate with the
nix daemon. The RestrictAddressFamilies hardening was blocking this.
Also trim trailing newlines from stderr in error messages.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

module.nix

@@ -114,7 +114,9 @@ in
         ProtectKernelTunables = true;
         ProtectKernelModules = true;
         ProtectControlGroups = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        # AF_UNIX required for nix daemon communication when flake collector enabled
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]
+          ++ lib.optionals cfg.flake.enable [ "AF_UNIX" ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;